The present invention is related to monitoring systems for communications networks and, more particularly, to detecting, capturing and correlating signaling units for transactions in a Signaling System Seven (SS7) network.
Common channel signaling networks, such as the Signaling System Seven (SS7) based signal system, use dedicated channels to pass digital messages between systems for call setup, call control, call routing, and other functions. These dedicated signaling channels are part of a network that is separate from the network that carries the actual voice and data signals. An SS7 network is a separate switching system which is used prior to, during, and at the end of an actual voice or data call. The SS7 network is used to route control information. Whenever two switches or elements have to pass call control information during or prior to a phone call, they pass this data via the SS7 signaling network.
There are three basic types of network node elements in an SS7 network. One of them is the Service Switching Point (SSP), which may be a central office switch, a tandem switch or an end office switch. A second principal node element is the Service Control Point (SCP). An SCP acts as a database query server for the rest of the network. An SCP is used in such applications as translating ported telephone numbers, routing 800 calls, tracking roamers in a cellular network, and Alternate Billing Service/Line Identification Database services (or ABS/LIDB) which provide operator-type services. The third principal node element is the Signal Transfer point (STP). An STP is essentially a packet switch that routes the messages from SSPs and SCPs to SSPs and SCPs.
It is possible to combine these three different types of nodes into a single node. However, in North America, they are typically not combined. An SSP performs only switch functions, an SCP only control functions, and an STP only signal transfer functions. In European telecommunications systems, all of these different functions may be combined into one node.
The SS7 network carries a great deal of information and is extremely critical to the operation of the phone system. If an SS7 network is not functioning, or if portions of it are not operating, the phone system simply cannot deliver phone calls, even though all of the voice circuits are operating properly. The capacity and complexity of the SS7 network is small in terms of circuitry and bandwidth utilized by an end user compared to previous voice and data networks. The circuitry of the SS7 network is therefore much more critical. The actual elements in the SS7 network do not provide all the information required in network operations to manage and to determine the health and state of an SS7 network. It is therefore necessary for the telephone industry to deploy surveillance equipment to monitor the links connecting the nodes of the SS7 network.
The topology of the network is such that STPs are typically deployed in a mated pair configuration at geographically separate locations. Connected to a mated pair of STPs will be a set of SSPs and SCPs. This conglomeration of SSPs, SCPs and mated Pair STPs is called a cluster. Clusters are then connected by D-Quad links between STP mated pairs.
When any transaction or message is sent between two different devices on the network, it is often the case that the messages going from switch A to switch B travel one route on the network while the messages going from switch B to switch A travel a different route. The network surveillance equipment that monitors the link is designed to capture and correlate as much signaling information as possible regardless of network activity. Because of the different data paths that messages may take, it is difficult to do this correlation above what is called the transport layer when monitoring links at the STP sites. An example of an application level problem would be where a subscriber has a problem getting his/her calls delivered. The telephone company may attempt to fix the problem by doing a trace of all data pertaining to that subscriber""s phone number, but the data may not all be located at one point. The data may be all in one STP, or split in some fashion, partially in one STP and partially in the other STP of a mated pair, which may be in a different city many miles away. Accordingly, there is a need for a system which correlates and combines messages and other data in an SS7 network.
It is an object of the present invention to provide a system and method for capturing substantially all of the transaction messages or signaling units in an SS7 network.
It is a further object of the present invention to combine all transaction signaling units corresponding to a particular transaction into a single transaction record.
These and other objects, features and technical advantages are achieved by a system and method in which monitoring units non-intrusively capture substantially all of the transaction signaling units or messages from the links in a communications network, such as an SS7 network. Each of the transaction signaling units correspond to a particular transaction in the network. The present system correlates the signaling units using transaction processors. All of the captured transaction signaling units are sent to transaction processors. The transaction processors use the transaction identifier that has been assigned to each transaction messages. All of the transaction signaling units that are related to a particular transaction have the same transaction identifier. The system has the capability to move signaling units among the transaction processors and among the monitoring units so that all transaction messages for one transaction are combined into one transaction record.
Automated monitoring equipment that continually monitors, in real time, the delivery of all calls over the signaling network is disclosed in U.S. Pat. No. 5,592,530, entitled TELEPHONE SWITCH DUAL MONITORS; and in application Ser. No. 09/057,940, filed Apr. 4, 1998, entitled SYSTEM AND METHOD FOR MONITORING PERFORMANCE STATISTICS IN A COMMUNICATIONS NETWORK, now U.S. Pat. No. 6,028,914 the disclosure of which is hereby incorporated by reference herein.
When a network element, such as an STP, SCP, SSP or end office, originates a transaction signaling unit or message for a new transaction, the transaction is assigned a transaction identifier that is unique to the originating network element. Any other messages that are generated for this transaction, or in response to a transaction message, will contain a transaction identifier that is unique to the destination network element. Additionally, a destination network element will generate a second unique transaction identifier for the same transaction. Each transaction message also comprises data components, which identify the point code of the originating and/or destination network element for each transaction message.
When a monitoring unit initially captures a transaction signaling unit, the monitor attempts to process that signaling unit locally on a first transaction processor. If the local transaction processor determines, based upon the transaction identifiers and point codes, that the signaling unit belongs to a transaction which is not being processed on the first transaction processor, then the signaling unit will be forwarded either to a second transaction processor on the local monitor or to another monitor. When the local monitor receives signaling units from remote monitors, the signaling unit is assigned to a transaction processor based upon the transaction identifiers and the point codes.
Transaction processors have the capability to transfer signaling units to other transaction processors. However, no signaling unit will be forwarded more than once among transaction processors on the same monitor and no message will be forwarded among monitors more than once. If a message is transferred a maximum number of times and no corresponding transaction is found, then the message will be ignored.
A single message may be detected on multiple links at different times. Also, monitoring units may detect, or receive messages from other monitoring units, out of time-order. Accordingly, each message is time-stamped when it is detected. The present invention time sorts the transaction messages. The transaction processors correlate multiple detections of a single message into a single unified message, thereby reducing the number of messages processed.
It is a feature of the present invention to capture a large volume of signaling units from geographically diversified locations and to combine them, in real-time, into distinct transaction records.
It is a feature of the present invention to use the originating and destination transaction identifiers to sort and route each transaction message to the proper processor for that transaction.
It is an additional feature of the present invention to use the origination and destination point codes in transaction messages to sort each transaction to the proper processor.
It is a further feature of the present invention to efficiently transfer signaling units among the monitoring units and among processors on each of the monitoring units. Such transfers are limited to prevent excessive processing of unassigned transactions.
It is another feature of the present invention to sort all detected messages by time of detection before correlating signaling units and transactions. Multiple detections of the same signaling unit are also combined into a single signaling unit message which comprises all the data of the individual messages. As a result, messages that are captured both when entering and when exiting a network node are correlated into a single message. Messages may be sorted both at the start and/or at the end of the correlation processing performed by the transaction processors.
It is a feature of the present invention to combine correlated transaction messages into transaction record that can be further processed, in real-time, by application processors or state machines.
The foregoing has outlined rather broadly the features and technical advantages of the present invention in order that the detailed description of the invention that follows may be better understood. Additional features and advantages of the invention will be described hereinafter which form the subject of the claims of the invention. It should be appreciated by those skilled in the art that the conception and the specific embodiment disclosed may be readily utilized as a basis for modifying or designing other structures for carrying out the same purposes of the present invention. It should also be realized by those skilled in the art that such equivalent constructions do not depart from the spirit and scope of the invention as set forth in the appended claims.